Application programming interface wall

• US 9,729,506 B2
• Filed: 08/22/2014
• Issued: 08/08/2017
• Est. Priority Date: 08/22/2014
• Status: Active Grant

• Current Assignee: Shape Security Inc. (F5 Incorporated)
• Original Assignee: Shape Security Inc. (F5 Incorporated)
• Inventors: Call, Justin D., Peacock, Timothy D.
• Primary Examiner(s): Parsons, Theodore C
• Application Number:
  US14/466,779
• Publication Number:
  US 20160057107A1
• Time in Patent Office: 1,082 Days
• Field of Search: 726 11- 12, 726 22
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

Application programming interfaces (APIs) can be unintentionally exposed and allow for potentially undesirable use of corporate resources. An API call filtering system configured to monitor API call requests received via an endpoint and API call responses received via a supporting service of an API or web service. The API call filtering system enables enterprises to improve their security posture by identifying, studying, reporting, and securing their APIs within their enterprise network.

Claims

1. An application programming interface (API) call filtering system to filter API call requests received, via a network, from a device that is network-connected and configured to run endpoint application hardware and/or software, to secure an API service that accepts API call requests and provides API call responses thereto, the system comprising:

at least one computing device configured to implement one or more services, wherein the one or more services are configured to;

a) monitor, at an API filter, a plurality of API call requests received from one or more endpoint application directed to a server configured to provide, at least in part, the API service;

b) monitor authentication methods of the plurality of API call requests;

c) compile authentication method information over the plurality of API call requests;

d) compile performance indicators of the plurality of API call requests;

e) analyze the compiled performance indicators;

f) create at least one report based at least in part, on the compiled performance indicators and compiled authentication method information;

g) modify an authentication method of at least one incoming API call request in response to a security team input following an output of the at least one report, to form a modified incoming API call request that is processable by the server as the server is configured for the incoming API call request, wherein modifying an authentication method comprises, for at least some incoming API call requests, creating a requirement that the at least one incoming API call request satisfy an authentication test that the at least one incoming API call request would not have otherwise had to satisfy; and

h) send the modified incoming API call request to the server.

2. The API call filtering system of claim 1, wherein the device is a user device or a machine-to-machine device.

3. The API call filtering system of claim 1, wherein the API filter initially includes no information of the API to which the plurality of API call requests are transmitted.

4. The API call filtering system of claim 1, wherein the performance indicators include a frequency, a velocity, a time of day, a geo-location, or an authentication indicator related to the plurality of API call requests.

5. The API call filtering system of claim 1, wherein the at least one report includes analysis of the performance indicators and at least one recommendation of an action or non-action to take in response to each of at least some of the incoming API call requests.

6. The API call filtering system of claim 1, wherein the one or more services are further configured to:

obtain the performance indicators;

determine identification criteria based, at least in part, on the performance indicators; and

identify, using the identification criteria, the API to which the plurality of API call requests are transmitted.

7. The API call filtering system of claim 1, wherein the one or more services are further configured to:

create an access control list (ACL) for the API; and

change access permissions in the ACL for the API, wherein the access permission changes include modifying access to the API, limiting access to the API, or blocking access to the API.

8. The API call filtering system of claim 7, wherein limiting access to the API comprises at least throttling or reducing throughput.

9. The API call filtering system of claim 7, wherein the one or more services are further configured to change the access permissions for the API from unauthenticated access permissions to authenticated access permissions.

10. The API call filtering system of claim 1, wherein the incoming API call request received from the one or more endpoint application includes requests to authenticate the one or more endpoint application with respect to a secure account maintained at, or for, the API service.

11. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, wherein the computer system is an application programming interface (API) wall, cause the computer system to at least:

identify, at an API wall, a plurality of API call requests for a web service, the plurality of API call requests transmitted from endpoints to a server, wherein the server is a component of an enterprise network;

identify, at the API wall, a plurality of API call responses transmitted from the server;

collect business intelligence related to the plurality of API call requests and the plurality of API call responses, the business intelligence including statistics and properties of the endpoint;

compile a report, the report including statistics, analysis, and/or recommendations related to the plurality of API call requests, wherein the report includes authentication method information of the plurality of API call requests;

create, via the API wall, a dashboard including information related to API use across the enterprise network; and

provide, via the API wall, control mechanisms for modifying access to an API, limiting access to the API, creating access control lists (ACLs), and enforcing ACLs, wherein control mechanisms operate in response to security team inputs following output of the report, wherein modifying access comprises modifying an authentication method of at least one incoming API call request that, for at least some incoming API call requests, creates a requirement that the at least one incoming API call request satisfy an authentication test that the at least one incoming API call request would not have otherwise had to satisfy.

12. The non-transitory computer-readable storage medium of claim 11, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to create, via the API wall, a list of APIs that are called across an enterprise network.

13. The non-transitory computer-readable storage medium of claim 11, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to record traffic over the network from an endpoint to a web server, the web server configured to provide web services in response to an API call request from one or more of the endpoints.

14. The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to record traffic over the network further include instructions that cause the computer system to:

systematically browse web assets to identify traffic that originates from browser-driven website interaction; and

remove identified browser-driven website interaction traffic from the traffic recorded over the network in order to improve identification of API calls.

15. The non-transitory computer-readable storage medium of claim 11, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to collect properties determined at the API wall, the properties including measured frequency, measured velocity, time of day, geo-location, or response times.

16. The non-transitory computer-readable storage medium of claim 15, wherein the instructions that cause the computer system to collect properties further include instructions that cause the computer system to determine if APIs are chained together with an API call request to one leading to API call requests to another.

17. The non-transitory computer-readable storage medium of claim 11, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to require access via the API wall, by an endpoint, over Transport Layer Security (TLS).

18. The non-transitory computer-readable storage medium of claim 11, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to:

identify libraries and/or middleware that include an API; and

record commonly abused APIs in the identified libraries and/or middleware based, at least in part, on information collected at the API wall.

19. The non-transitory computer-readable storage medium of claim 11, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to:

identify libraries and/or middleware that include an API; and

record human-compiled data relating to commonly abused APIs.

20. A computer-implemented method for filtering application programming interface (API) calls in a secured network environment, the computer-implemented method, comprising:

providing an API wall device at a logical perimeter of a secured network;

monitoring, at the API wall device, a plurality of API calls from a plurality of endpoint apps executing on user devices with the plurality of API calls directed to a secured server, wherein the secured server is within the logical perimeter of the secured network and the user devices are outside the logical perimeter of the secured network, and wherein monitoring can occur without requiring advance knowledge of endpoint apps of the plurality of endpoint apps, the API calls of the plurality of API calls, or the secured server;

aggregating statistics over the plurality of API calls to form a report relating to the statistics, the report including authentication method information over the plurality of API calls;

outputting the report to a security team tasked with maintaining security for the secured network;

receiving inputs from the security team; and

processing a received API call based on the inputs from the security team, wherein processing includes modifying an authentication method for at least some received API call requests based on the inputs.

21. The computer-implemented method of claim 20, wherein the statistics are statistics relating to the plurality of endpoint apps, the user devices on which plurality of endpoint apps are running, and API call usage statistics.

22. The computer-implemented method of claim 20, further comprising:

enforcing transport layer security (TLS) between the plurality of endpoint apps and the API wall when the secured server is not configured to require transport layer security (TLS);

forwarding selected API calls from the API wall to the secured server when the selected API calls are received using transport layer security (TLS), wherein the selected API calls are modified to be consistent with a secured server interface; and

deleting API calls at the API wall that are received without transport layer security (TLS).

23. The computer-implemented method of claim 20, further comprising:

determining a first authentication method used between an endpoint app of the plurality of endpoint apps and the API wall;

determining a required authentication method security level for the received API call;

if the first authentication method is a less secure authentication method relative to the required authentication method security level, modifying the received API call to form a modified API call that uses a second authentication method that is at least as secure as the required authentication method security level; and

forwarding the received API call or the modified API call, to the secured server.

24. The computer-implemented method of claim 23, wherein the first authentication method uses a user-created username and password pair and the second authentication method uses a digital certificate issued and verified by a public key infrastructure certificate authority.

25. The computer-implemented method of claim 20, wherein monitoring the plurality of API calls from a plurality of endpoint apps comprises:

identify web assets;

determine which API calls comprise browser-driven website interaction; and

omitting browser-driven website API calls from monitoring.